Threat Model Entity Tags in Bulk

ThreatStream enables you to manage tags of threat model entities in bulk. You can use the information in this section to add and delete tags associated with sets of the following entities: Actors, Attack Patterns, Campaigns, Incidents, Malware, Signatures, Threat Bulletins, TTPs, and Vulnerabilities.

Request

/api/v1/<entity_type>/bulk_tagging/

where <entity_type> is the type of threat model entity on which you are adding the tag (actor, attackpattern, campaign, incident, malware, signature, tipreport, ttp, or vulnerability.)

HTTP Method: POST

Attributes

Attribute Description
ids Unique IDs of the threat model entities to which you are adding tags.
remove_tags

Tags must be specified as follows:

remove_tags:[{“name”:"my_tag"},{"name":"my_tag2"},{"name":"my_tag3"}]

By default, you can delete up to 25 tags in bulk from a threat model entity.
tags

Tags that will be applied to the specified threat model entities.

Tags must be specified as follows:

tags: [{"name": "my_tag","tlp": "red"},{"name": "my_tag2","tlp": "clear"},{"name": "my_tag3"}]

Tag Attributes:

  • name—name of the tag that you want to add.

  • tlp—the visibility setting for the tag. Possible values: red, amber, amber+strict, green, clear.

  • red—private, or visible to your organization only.

  • white—public, or visible to all ThreatStream users with access to the data. Default: white.

    Note: Adding public tags may be restricted by your Organization Administrator.

    In the example above, my_tag is private and my_tag2 and my_tag3 are public.

By default, you can add up to 25 tags in bulk to a threat model entity.

Example

To add tags private_tag1, private_tag2, and public_tag to the set of Actors whose IDs are 655, 2784, 2785 and to remove tag4 from these Actors:

Copy 
curl  -X POST 'https://api.threatstream.com/api/v1/actor/bulk_tagging/' -d '{"ids": [655, 2784, 2785], "tags": [{"name":"private_tag1", "tlp":"red"}, {"name":"public_tag", "tlp":"white"}, {"name":"private_tag3", "tlp":"red"}], "remove_tags": [{"name":"tag4"}]}' -H 'content-type: application/json' -H 'Authorization:apikey <username>:<apikey>'